1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450 |
- From: Pablo Neira Ayuso <pablo@netfilter.org>
- Date: Tue, 9 Jan 2018 02:38:03 +0100
- Subject: [PATCH] netfilter: nf_tables: add single table list for all families
- Place all existing user defined tables in struct net *, instead of
- having one list per family. This saves us from one level of indentation
- in netlink dump functions.
- Place pointer to struct nft_af_info in struct nft_table temporarily, as
- we still need this to put back reference module reference counter on
- table removal.
- This patch comes in preparation for the removal of struct nft_af_info.
- Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
- ---
- --- a/include/net/netfilter/nf_tables.h
- +++ b/include/net/netfilter/nf_tables.h
- @@ -145,22 +145,22 @@ static inline void nft_data_debug(const
- * struct nft_ctx - nf_tables rule/set context
- *
- * @net: net namespace
- - * @afi: address family info
- * @table: the table the chain is contained in
- * @chain: the chain the rule is contained in
- * @nla: netlink attributes
- * @portid: netlink portID of the original message
- * @seq: netlink sequence number
- + * @family: protocol family
- * @report: notify via unicast netlink message
- */
- struct nft_ctx {
- struct net *net;
- - struct nft_af_info *afi;
- struct nft_table *table;
- struct nft_chain *chain;
- const struct nlattr * const *nla;
- u32 portid;
- u32 seq;
- + u8 family;
- bool report;
- };
-
- @@ -947,6 +947,7 @@ unsigned int nft_do_chain(struct nft_pkt
- * @use: number of chain references to this table
- * @flags: table flag (see enum nft_table_flags)
- * @genmask: generation mask
- + * @afinfo: address family info
- * @name: name of the table
- */
- struct nft_table {
- @@ -959,6 +960,7 @@ struct nft_table {
- u32 use;
- u16 flags:14,
- genmask:2;
- + struct nft_af_info *afi;
- char *name;
- };
-
- @@ -968,13 +970,11 @@ struct nft_table {
- * @list: used internally
- * @family: address family
- * @owner: module owner
- - * @tables: used internally
- */
- struct nft_af_info {
- struct list_head list;
- int family;
- struct module *owner;
- - struct list_head tables;
- };
-
- int nft_register_afinfo(struct net *, struct nft_af_info *);
- --- a/include/net/netns/nftables.h
- +++ b/include/net/netns/nftables.h
- @@ -8,6 +8,7 @@ struct nft_af_info;
-
- struct netns_nftables {
- struct list_head af_info;
- + struct list_head tables;
- struct list_head commit_list;
- struct nft_af_info *ipv4;
- struct nft_af_info *ipv6;
- --- a/net/netfilter/nf_tables_api.c
- +++ b/net/netfilter/nf_tables_api.c
- @@ -37,7 +37,6 @@ static LIST_HEAD(nf_tables_flowtables);
- */
- int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
- {
- - INIT_LIST_HEAD(&afi->tables);
- nfnl_lock(NFNL_SUBSYS_NFTABLES);
- list_add_tail_rcu(&afi->list, &net->nft.af_info);
- nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- @@ -99,13 +98,13 @@ static void nft_ctx_init(struct nft_ctx
- struct net *net,
- const struct sk_buff *skb,
- const struct nlmsghdr *nlh,
- - struct nft_af_info *afi,
- + u8 family,
- struct nft_table *table,
- struct nft_chain *chain,
- const struct nlattr * const *nla)
- {
- ctx->net = net;
- - ctx->afi = afi;
- + ctx->family = family;
- ctx->table = table;
- ctx->chain = chain;
- ctx->nla = nla;
- @@ -429,30 +428,31 @@ static int nft_delflowtable(struct nft_c
- * Tables
- */
-
- -static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
- +static struct nft_table *nft_table_lookup(const struct net *net,
- const struct nlattr *nla,
- - u8 genmask)
- + u8 family, u8 genmask)
- {
- struct nft_table *table;
-
- - list_for_each_entry(table, &afi->tables, list) {
- + list_for_each_entry(table, &net->nft.tables, list) {
- if (!nla_strcmp(nla, table->name) &&
- + table->afi->family == family &&
- nft_active_genmask(table, genmask))
- return table;
- }
- return NULL;
- }
-
- -static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
- +static struct nft_table *nf_tables_table_lookup(const struct net *net,
- const struct nlattr *nla,
- - u8 genmask)
- + u8 family, u8 genmask)
- {
- struct nft_table *table;
-
- if (nla == NULL)
- return ERR_PTR(-EINVAL);
-
- - table = nft_table_lookup(afi, nla, genmask);
- + table = nft_table_lookup(net, nla, family, genmask);
- if (table != NULL)
- return table;
-
- @@ -551,7 +551,7 @@ static void nf_tables_table_notify(const
- goto err;
-
- err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
- - event, 0, ctx->afi->family, ctx->table);
- + event, 0, ctx->family, ctx->table);
- if (err < 0) {
- kfree_skb(skb);
- goto err;
- @@ -568,7 +568,6 @@ static int nf_tables_dump_tables(struct
- struct netlink_callback *cb)
- {
- const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
- - const struct nft_af_info *afi;
- const struct nft_table *table;
- unsigned int idx = 0, s_idx = cb->args[0];
- struct net *net = sock_net(skb->sk);
- @@ -577,30 +576,27 @@ static int nf_tables_dump_tables(struct
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (family != NFPROTO_UNSPEC && family != afi->family)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (family != NFPROTO_UNSPEC && family != table->afi->family)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - if (idx < s_idx)
- - goto cont;
- - if (idx > s_idx)
- - memset(&cb->args[1], 0,
- - sizeof(cb->args) - sizeof(cb->args[0]));
- - if (!nft_is_active(net, table))
- - continue;
- - if (nf_tables_fill_table_info(skb, net,
- - NETLINK_CB(cb->skb).portid,
- - cb->nlh->nlmsg_seq,
- - NFT_MSG_NEWTABLE,
- - NLM_F_MULTI,
- - afi->family, table) < 0)
- - goto done;
- + if (idx < s_idx)
- + goto cont;
- + if (idx > s_idx)
- + memset(&cb->args[1], 0,
- + sizeof(cb->args) - sizeof(cb->args[0]));
- + if (!nft_is_active(net, table))
- + continue;
- + if (nf_tables_fill_table_info(skb, net,
- + NETLINK_CB(cb->skb).portid,
- + cb->nlh->nlmsg_seq,
- + NFT_MSG_NEWTABLE, NLM_F_MULTI,
- + table->afi->family, table) < 0)
- + goto done;
-
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- + idx++;
- }
- done:
- rcu_read_unlock();
- @@ -632,7 +628,8 @@ static int nf_tables_gettable(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -763,7 +760,7 @@ static int nf_tables_newtable(struct net
- return PTR_ERR(afi);
-
- name = nla[NFTA_TABLE_NAME];
- - table = nf_tables_table_lookup(afi, name, genmask);
- + table = nf_tables_table_lookup(net, name, afi->family, genmask);
- if (IS_ERR(table)) {
- if (PTR_ERR(table) != -ENOENT)
- return PTR_ERR(table);
- @@ -773,7 +770,7 @@ static int nf_tables_newtable(struct net
- if (nlh->nlmsg_flags & NLM_F_REPLACE)
- return -EOPNOTSUPP;
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- return nf_tables_updtable(&ctx);
- }
-
- @@ -800,14 +797,15 @@ static int nf_tables_newtable(struct net
- INIT_LIST_HEAD(&table->sets);
- INIT_LIST_HEAD(&table->objects);
- INIT_LIST_HEAD(&table->flowtables);
- + table->afi = afi;
- table->flags = flags;
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
- if (err < 0)
- goto err4;
-
- - list_add_tail_rcu(&table->list, &afi->tables);
- + list_add_tail_rcu(&table->list, &net->nft.tables);
- return 0;
- err4:
- kfree(table->name);
- @@ -881,30 +879,28 @@ out:
-
- static int nft_flush(struct nft_ctx *ctx, int family)
- {
- - struct nft_af_info *afi;
- struct nft_table *table, *nt;
- const struct nlattr * const *nla = ctx->nla;
- int err = 0;
-
- - list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
- - if (family != AF_UNSPEC && afi->family != family)
- + list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
- + if (family != AF_UNSPEC && table->afi->family != family)
- continue;
-
- - ctx->afi = afi;
- - list_for_each_entry_safe(table, nt, &afi->tables, list) {
- - if (!nft_is_active_next(ctx->net, table))
- - continue;
- + ctx->family = table->afi->family;
-
- - if (nla[NFTA_TABLE_NAME] &&
- - nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
- - continue;
- + if (!nft_is_active_next(ctx->net, table))
- + continue;
-
- - ctx->table = table;
- + if (nla[NFTA_TABLE_NAME] &&
- + nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
- + continue;
-
- - err = nft_flush_table(ctx);
- - if (err < 0)
- - goto out;
- - }
- + ctx->table = table;
- +
- + err = nft_flush_table(ctx);
- + if (err < 0)
- + goto out;
- }
- out:
- return err;
- @@ -922,7 +918,7 @@ static int nf_tables_deltable(struct net
- int family = nfmsg->nfgen_family;
- struct nft_ctx ctx;
-
- - nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
- if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
- return nft_flush(&ctx, family);
-
- @@ -930,7 +926,8 @@ static int nf_tables_deltable(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -938,7 +935,7 @@ static int nf_tables_deltable(struct net
- table->use > 0)
- return -EBUSY;
-
- - ctx.afi = afi;
- + ctx.family = afi->family;
- ctx.table = table;
-
- return nft_flush_table(&ctx);
- @@ -950,7 +947,7 @@ static void nf_tables_table_destroy(stru
-
- kfree(ctx->table->name);
- kfree(ctx->table);
- - module_put(ctx->afi->owner);
- + module_put(ctx->table->afi->owner);
- }
-
- int nft_register_chain_type(const struct nf_chain_type *ctype)
- @@ -1151,7 +1148,7 @@ static void nf_tables_chain_notify(const
- goto err;
-
- err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
- - event, 0, ctx->afi->family, ctx->table,
- + event, 0, ctx->family, ctx->table,
- ctx->chain);
- if (err < 0) {
- kfree_skb(skb);
- @@ -1169,7 +1166,6 @@ static int nf_tables_dump_chains(struct
- struct netlink_callback *cb)
- {
- const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
- - const struct nft_af_info *afi;
- const struct nft_table *table;
- const struct nft_chain *chain;
- unsigned int idx = 0, s_idx = cb->args[0];
- @@ -1179,31 +1175,30 @@ static int nf_tables_dump_chains(struct
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (family != NFPROTO_UNSPEC && family != afi->family)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (family != NFPROTO_UNSPEC && family != table->afi->family)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - list_for_each_entry_rcu(chain, &table->chains, list) {
- - if (idx < s_idx)
- - goto cont;
- - if (idx > s_idx)
- - memset(&cb->args[1], 0,
- - sizeof(cb->args) - sizeof(cb->args[0]));
- - if (!nft_is_active(net, chain))
- - continue;
- - if (nf_tables_fill_chain_info(skb, net,
- - NETLINK_CB(cb->skb).portid,
- - cb->nlh->nlmsg_seq,
- - NFT_MSG_NEWCHAIN,
- - NLM_F_MULTI,
- - afi->family, table, chain) < 0)
- - goto done;
- + list_for_each_entry_rcu(chain, &table->chains, list) {
- + if (idx < s_idx)
- + goto cont;
- + if (idx > s_idx)
- + memset(&cb->args[1], 0,
- + sizeof(cb->args) - sizeof(cb->args[0]));
- + if (!nft_is_active(net, chain))
- + continue;
- + if (nf_tables_fill_chain_info(skb, net,
- + NETLINK_CB(cb->skb).portid,
- + cb->nlh->nlmsg_seq,
- + NFT_MSG_NEWCHAIN,
- + NLM_F_MULTI,
- + table->afi->family, table,
- + chain) < 0)
- + goto done;
-
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- + idx++;
- }
- }
- done:
- @@ -1237,7 +1232,8 @@ static int nf_tables_getchain(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -1347,8 +1343,8 @@ struct nft_chain_hook {
-
- static int nft_chain_parse_hook(struct net *net,
- const struct nlattr * const nla[],
- - struct nft_af_info *afi,
- - struct nft_chain_hook *hook, bool create)
- + struct nft_chain_hook *hook, u8 family,
- + bool create)
- {
- struct nlattr *ha[NFTA_HOOK_MAX + 1];
- const struct nf_chain_type *type;
- @@ -1367,10 +1363,10 @@ static int nft_chain_parse_hook(struct n
- hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
- hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
-
- - type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
- + type = chain_type[family][NFT_CHAIN_T_DEFAULT];
- if (nla[NFTA_CHAIN_TYPE]) {
- type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
- - afi->family, create);
- + family, create);
- if (IS_ERR(type))
- return PTR_ERR(type);
- }
- @@ -1382,7 +1378,7 @@ static int nft_chain_parse_hook(struct n
- hook->type = type;
-
- hook->dev = NULL;
- - if (afi->family == NFPROTO_NETDEV) {
- + if (family == NFPROTO_NETDEV) {
- char ifname[IFNAMSIZ];
-
- if (!ha[NFTA_HOOK_DEV]) {
- @@ -1417,7 +1413,6 @@ static int nf_tables_addchain(struct nft
- {
- const struct nlattr * const *nla = ctx->nla;
- struct nft_table *table = ctx->table;
- - struct nft_af_info *afi = ctx->afi;
- struct nft_base_chain *basechain;
- struct nft_stats __percpu *stats;
- struct net *net = ctx->net;
- @@ -1431,7 +1426,7 @@ static int nf_tables_addchain(struct nft
- struct nft_chain_hook hook;
- struct nf_hook_ops *ops;
-
- - err = nft_chain_parse_hook(net, nla, afi, &hook, create);
- + err = nft_chain_parse_hook(net, nla, &hook, family, create);
- if (err < 0)
- return err;
-
- @@ -1523,7 +1518,7 @@ static int nf_tables_updchain(struct nft
- if (!nft_is_base_chain(chain))
- return -EBUSY;
-
- - err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
- + err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
- create);
- if (err < 0)
- return err;
- @@ -1633,7 +1628,8 @@ static int nf_tables_newchain(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -1673,7 +1669,7 @@ static int nf_tables_newchain(struct net
- }
- }
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-
- if (chain != NULL) {
- if (nlh->nlmsg_flags & NLM_F_EXCL)
- @@ -1707,7 +1703,8 @@ static int nf_tables_delchain(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -1719,7 +1716,7 @@ static int nf_tables_delchain(struct net
- chain->use > 0)
- return -EBUSY;
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-
- use = chain->use;
- list_for_each_entry(rule, &chain->rules, list) {
- @@ -1887,7 +1884,7 @@ static int nf_tables_expr_parse(const st
- if (err < 0)
- return err;
-
- - type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
- + type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
- if (IS_ERR(type))
- return PTR_ERR(type);
-
- @@ -2115,7 +2112,7 @@ static void nf_tables_rule_notify(const
- goto err;
-
- err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
- - event, 0, ctx->afi->family, ctx->table,
- + event, 0, ctx->family, ctx->table,
- ctx->chain, rule);
- if (err < 0) {
- kfree_skb(skb);
- @@ -2139,7 +2136,6 @@ static int nf_tables_dump_rules(struct s
- {
- const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
- const struct nft_rule_dump_ctx *ctx = cb->data;
- - const struct nft_af_info *afi;
- const struct nft_table *table;
- const struct nft_chain *chain;
- const struct nft_rule *rule;
- @@ -2150,39 +2146,37 @@ static int nf_tables_dump_rules(struct s
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (family != NFPROTO_UNSPEC && family != afi->family)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (family != NFPROTO_UNSPEC && family != table->afi->family)
- + continue;
- +
- + if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - if (ctx && ctx->table &&
- - strcmp(ctx->table, table->name) != 0)
- + list_for_each_entry_rcu(chain, &table->chains, list) {
- + if (ctx && ctx->chain &&
- + strcmp(ctx->chain, chain->name) != 0)
- continue;
-
- - list_for_each_entry_rcu(chain, &table->chains, list) {
- - if (ctx && ctx->chain &&
- - strcmp(ctx->chain, chain->name) != 0)
- - continue;
- -
- - list_for_each_entry_rcu(rule, &chain->rules, list) {
- - if (!nft_is_active(net, rule))
- - goto cont;
- - if (idx < s_idx)
- - goto cont;
- - if (idx > s_idx)
- - memset(&cb->args[1], 0,
- - sizeof(cb->args) - sizeof(cb->args[0]));
- - if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
- - cb->nlh->nlmsg_seq,
- - NFT_MSG_NEWRULE,
- - NLM_F_MULTI | NLM_F_APPEND,
- - afi->family, table, chain, rule) < 0)
- - goto done;
- + list_for_each_entry_rcu(rule, &chain->rules, list) {
- + if (!nft_is_active(net, rule))
- + goto cont;
- + if (idx < s_idx)
- + goto cont;
- + if (idx > s_idx)
- + memset(&cb->args[1], 0,
- + sizeof(cb->args) - sizeof(cb->args[0]));
- + if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
- + cb->nlh->nlmsg_seq,
- + NFT_MSG_NEWRULE,
- + NLM_F_MULTI | NLM_F_APPEND,
- + table->afi->family,
- + table, chain, rule) < 0)
- + goto done;
-
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- + idx++;
- }
- }
- }
- @@ -2260,7 +2254,8 @@ static int nf_tables_getrule(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -2345,7 +2340,8 @@ static int nf_tables_newrule(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -2384,7 +2380,7 @@ static int nf_tables_newrule(struct net
- return PTR_ERR(old_rule);
- }
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-
- n = 0;
- size = 0;
- @@ -2517,7 +2513,8 @@ static int nf_tables_delrule(struct net
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -2528,7 +2525,7 @@ static int nf_tables_delrule(struct net
- return PTR_ERR(chain);
- }
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-
- if (chain) {
- if (nla[NFTA_RULE_HANDLE]) {
- @@ -2726,13 +2723,13 @@ static int nft_ctx_init_from_setattr(str
- if (afi == NULL)
- return -EAFNOSUPPORT;
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
- - genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
- + afi->family, genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
- }
-
- - nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
- return 0;
- }
-
- @@ -2860,7 +2857,7 @@ static int nf_tables_fill_set(struct sk_
- goto nla_put_failure;
-
- nfmsg = nlmsg_data(nlh);
- - nfmsg->nfgen_family = ctx->afi->family;
- + nfmsg->nfgen_family = ctx->family;
- nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
-
- @@ -2953,10 +2950,8 @@ static int nf_tables_dump_sets(struct sk
- {
- const struct nft_set *set;
- unsigned int idx, s_idx = cb->args[0];
- - struct nft_af_info *afi;
- struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
- struct net *net = sock_net(skb->sk);
- - int cur_family = cb->args[3];
- struct nft_ctx *ctx = cb->data, ctx_set;
-
- if (cb->args[1])
- @@ -2965,51 +2960,44 @@ static int nf_tables_dump_sets(struct sk
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (ctx->afi && ctx->afi != afi)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (ctx->family != NFPROTO_UNSPEC &&
- + ctx->family != table->afi->family)
- continue;
-
- - if (cur_family) {
- - if (afi->family != cur_family)
- - continue;
- + if (ctx->table && ctx->table != table)
- + continue;
-
- - cur_family = 0;
- - }
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - if (ctx->table && ctx->table != table)
- + if (cur_table) {
- + if (cur_table != table)
- continue;
-
- - if (cur_table) {
- - if (cur_table != table)
- - continue;
- + cur_table = NULL;
- + }
- + idx = 0;
- + list_for_each_entry_rcu(set, &table->sets, list) {
- + if (idx < s_idx)
- + goto cont;
- + if (!nft_is_active(net, set))
- + goto cont;
-
- - cur_table = NULL;
- + ctx_set = *ctx;
- + ctx_set.table = table;
- + ctx_set.family = table->afi->family;
- +
- + if (nf_tables_fill_set(skb, &ctx_set, set,
- + NFT_MSG_NEWSET,
- + NLM_F_MULTI) < 0) {
- + cb->args[0] = idx;
- + cb->args[2] = (unsigned long) table;
- + goto done;
- }
- - idx = 0;
- - list_for_each_entry_rcu(set, &table->sets, list) {
- - if (idx < s_idx)
- - goto cont;
- - if (!nft_is_active(net, set))
- - goto cont;
- -
- - ctx_set = *ctx;
- - ctx_set.table = table;
- - ctx_set.afi = afi;
- - if (nf_tables_fill_set(skb, &ctx_set, set,
- - NFT_MSG_NEWSET,
- - NLM_F_MULTI) < 0) {
- - cb->args[0] = idx;
- - cb->args[2] = (unsigned long) table;
- - cb->args[3] = afi->family;
- - goto done;
- - }
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- - if (s_idx)
- - s_idx = 0;
- + idx++;
- }
- + if (s_idx)
- + s_idx = 0;
- }
- cb->args[1] = 1;
- done:
- @@ -3222,11 +3210,12 @@ static int nf_tables_newset(struct net *
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-
- set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
- if (IS_ERR(set)) {
- @@ -3495,12 +3484,12 @@ static int nft_ctx_init_from_elemattr(st
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
- - genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
- + afi->family, genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- - nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
- return 0;
- }
-
- @@ -3605,7 +3594,6 @@ static int nf_tables_dump_set(struct sk_
- {
- struct nft_set_dump_ctx *dump_ctx = cb->data;
- struct net *net = sock_net(skb->sk);
- - struct nft_af_info *afi;
- struct nft_table *table;
- struct nft_set *set;
- struct nft_set_dump_args args;
- @@ -3617,21 +3605,19 @@ static int nf_tables_dump_set(struct sk_
- int event;
-
- rcu_read_lock();
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (afi != dump_ctx->ctx.afi)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
- + dump_ctx->ctx.family != table->afi->family)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - if (table != dump_ctx->ctx.table)
- - continue;
- + if (table != dump_ctx->ctx.table)
- + continue;
-
- - list_for_each_entry_rcu(set, &table->sets, list) {
- - if (set == dump_ctx->set) {
- - set_found = true;
- - break;
- - }
- + list_for_each_entry_rcu(set, &table->sets, list) {
- + if (set == dump_ctx->set) {
- + set_found = true;
- + break;
- }
- - break;
- }
- break;
- }
- @@ -3651,7 +3637,7 @@ static int nf_tables_dump_set(struct sk_
- goto nla_put_failure;
-
- nfmsg = nlmsg_data(nlh);
- - nfmsg->nfgen_family = afi->family;
- + nfmsg->nfgen_family = table->afi->family;
- nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
-
- @@ -3753,7 +3739,7 @@ static int nf_tables_fill_setelem_info(s
- goto nla_put_failure;
-
- nfmsg = nlmsg_data(nlh);
- - nfmsg->nfgen_family = ctx->afi->family;
- + nfmsg->nfgen_family = ctx->family;
- nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
-
- @@ -4003,7 +3989,7 @@ static int nft_add_set_elem(struct nft_c
- list_for_each_entry(binding, &set->bindings, list) {
- struct nft_ctx bind_ctx = {
- .net = ctx->net,
- - .afi = ctx->afi,
- + .family = ctx->family,
- .table = ctx->table,
- .chain = (struct nft_chain *)binding->chain,
- };
- @@ -4555,7 +4541,8 @@ static int nf_tables_newobj(struct net *
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -4573,7 +4560,7 @@ static int nf_tables_newobj(struct net *
- return 0;
- }
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-
- type = nft_obj_type_get(objtype);
- if (IS_ERR(type))
- @@ -4650,7 +4637,6 @@ struct nft_obj_filter {
- static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
- {
- const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
- - const struct nft_af_info *afi;
- const struct nft_table *table;
- unsigned int idx = 0, s_idx = cb->args[0];
- struct nft_obj_filter *filter = cb->data;
- @@ -4665,38 +4651,37 @@ static int nf_tables_dump_obj(struct sk_
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (family != NFPROTO_UNSPEC && family != afi->family)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (family != NFPROTO_UNSPEC && family != table->afi->family)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - list_for_each_entry_rcu(obj, &table->objects, list) {
- - if (!nft_is_active(net, obj))
- - goto cont;
- - if (idx < s_idx)
- - goto cont;
- - if (idx > s_idx)
- - memset(&cb->args[1], 0,
- - sizeof(cb->args) - sizeof(cb->args[0]));
- - if (filter && filter->table &&
- - strcmp(filter->table, table->name))
- - goto cont;
- - if (filter &&
- - filter->type != NFT_OBJECT_UNSPEC &&
- - obj->ops->type->type != filter->type)
- - goto cont;
- + list_for_each_entry_rcu(obj, &table->objects, list) {
- + if (!nft_is_active(net, obj))
- + goto cont;
- + if (idx < s_idx)
- + goto cont;
- + if (idx > s_idx)
- + memset(&cb->args[1], 0,
- + sizeof(cb->args) - sizeof(cb->args[0]));
- + if (filter && filter->table &&
- + strcmp(filter->table, table->name))
- + goto cont;
- + if (filter &&
- + filter->type != NFT_OBJECT_UNSPEC &&
- + obj->ops->type->type != filter->type)
- + goto cont;
-
- - if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
- - cb->nlh->nlmsg_seq,
- - NFT_MSG_NEWOBJ,
- - NLM_F_MULTI | NLM_F_APPEND,
- - afi->family, table, obj, reset) < 0)
- - goto done;
- + if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
- + cb->nlh->nlmsg_seq,
- + NFT_MSG_NEWOBJ,
- + NLM_F_MULTI | NLM_F_APPEND,
- + table->afi->family, table,
- + obj, reset) < 0)
- + goto done;
-
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- + idx++;
- }
- }
- done:
- @@ -4783,7 +4768,8 @@ static int nf_tables_getobj(struct net *
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -4843,7 +4829,8 @@ static int nf_tables_delobj(struct net *
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
- + genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -4854,7 +4841,7 @@ static int nf_tables_delobj(struct net *
- if (obj->use > 0)
- return -EBUSY;
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-
- return nft_delobj(&ctx, obj);
- }
- @@ -4892,7 +4879,7 @@ static void nf_tables_obj_notify(const s
- struct nft_object *obj, int event)
- {
- nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
- - ctx->afi->family, ctx->report, GFP_KERNEL);
- + ctx->family, ctx->report, GFP_KERNEL);
- }
-
- /*
- @@ -5082,7 +5069,7 @@ void nft_flow_table_iterate(struct net *
-
- rcu_read_lock();
- list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
- iter(&flowtable->data, data);
- }
- @@ -5130,7 +5117,8 @@ static int nf_tables_newflowtable(struct
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
- + afi->family, genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -5147,7 +5135,7 @@ static int nf_tables_newflowtable(struct
- return 0;
- }
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-
- flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
- if (!flowtable)
- @@ -5228,7 +5216,8 @@ static int nf_tables_delflowtable(struct
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
- + afi->family, genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -5239,7 +5228,7 @@ static int nf_tables_delflowtable(struct
- if (flowtable->use > 0)
- return -EBUSY;
-
- - nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
- + nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-
- return nft_delflowtable(&ctx, flowtable);
- }
- @@ -5308,40 +5297,37 @@ static int nf_tables_dump_flowtable(stru
- struct net *net = sock_net(skb->sk);
- int family = nfmsg->nfgen_family;
- struct nft_flowtable *flowtable;
- - const struct nft_af_info *afi;
- const struct nft_table *table;
-
- rcu_read_lock();
- cb->seq = net->nft.base_seq;
-
- - list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
- - if (family != NFPROTO_UNSPEC && family != afi->family)
- + list_for_each_entry_rcu(table, &net->nft.tables, list) {
- + if (family != NFPROTO_UNSPEC && family != table->afi->family)
- continue;
-
- - list_for_each_entry_rcu(table, &afi->tables, list) {
- - list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
- - if (!nft_is_active(net, flowtable))
- - goto cont;
- - if (idx < s_idx)
- - goto cont;
- - if (idx > s_idx)
- - memset(&cb->args[1], 0,
- - sizeof(cb->args) - sizeof(cb->args[0]));
- - if (filter && filter->table[0] &&
- - strcmp(filter->table, table->name))
- - goto cont;
- + list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
- + if (!nft_is_active(net, flowtable))
- + goto cont;
- + if (idx < s_idx)
- + goto cont;
- + if (idx > s_idx)
- + memset(&cb->args[1], 0,
- + sizeof(cb->args) - sizeof(cb->args[0]));
- + if (filter && filter->table &&
- + strcmp(filter->table, table->name))
- + goto cont;
-
- - if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
- - cb->nlh->nlmsg_seq,
- - NFT_MSG_NEWFLOWTABLE,
- - NLM_F_MULTI | NLM_F_APPEND,
- - afi->family, flowtable) < 0)
- - goto done;
- + if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
- + cb->nlh->nlmsg_seq,
- + NFT_MSG_NEWFLOWTABLE,
- + NLM_F_MULTI | NLM_F_APPEND,
- + table->afi->family, flowtable) < 0)
- + goto done;
-
- - nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
- - idx++;
- - }
- + idx++;
- }
- }
- done:
- @@ -5426,7 +5412,8 @@ static int nf_tables_getflowtable(struct
- if (IS_ERR(afi))
- return PTR_ERR(afi);
-
- - table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
- + table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
- + afi->family, genmask);
- if (IS_ERR(table))
- return PTR_ERR(table);
-
- @@ -5469,7 +5456,7 @@ static void nf_tables_flowtable_notify(s
-
- err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
- ctx->seq, event, 0,
- - ctx->afi->family, flowtable);
- + ctx->family, flowtable);
- if (err < 0) {
- kfree_skb(skb);
- goto err;
- @@ -5547,17 +5534,14 @@ static int nf_tables_flowtable_event(str
- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
- struct nft_flowtable *flowtable;
- struct nft_table *table;
- - struct nft_af_info *afi;
-
- if (event != NETDEV_UNREGISTER)
- return 0;
-
- nfnl_lock(NFNL_SUBSYS_NFTABLES);
- - list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
- - list_for_each_entry(table, &afi->tables, list) {
- - list_for_each_entry(flowtable, &table->flowtables, list) {
- - nft_flowtable_event(event, dev, flowtable);
- - }
- + list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
- + list_for_each_entry(flowtable, &table->flowtables, list) {
- + nft_flowtable_event(event, dev, flowtable);
- }
- }
- nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- @@ -6583,6 +6567,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
- static int __net_init nf_tables_init_net(struct net *net)
- {
- INIT_LIST_HEAD(&net->nft.af_info);
- + INIT_LIST_HEAD(&net->nft.tables);
- INIT_LIST_HEAD(&net->nft.commit_list);
- net->nft.base_seq = 1;
- return 0;
- @@ -6619,10 +6604,10 @@ static void __nft_release_afinfo(struct
- struct nft_set *set, *ns;
- struct nft_ctx ctx = {
- .net = net,
- - .afi = afi,
- + .family = afi->family,
- };
-
- - list_for_each_entry_safe(table, nt, &afi->tables, list) {
- + list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
- list_for_each_entry(chain, &table->chains, list)
- nf_tables_unregister_hook(net, table, chain);
- list_for_each_entry(flowtable, &table->flowtables, list)
- --- a/net/netfilter/nf_tables_netdev.c
- +++ b/net/netfilter/nf_tables_netdev.c
- @@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct
- unsigned long event, void *ptr)
- {
- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
- - struct nft_af_info *afi;
- struct nft_table *table;
- struct nft_chain *chain, *nr;
- struct nft_ctx ctx = {
- @@ -119,20 +118,18 @@ static int nf_tables_netdev_event(struct
- return NOTIFY_DONE;
-
- nfnl_lock(NFNL_SUBSYS_NFTABLES);
- - list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
- - ctx.afi = afi;
- - if (afi->family != NFPROTO_NETDEV)
- + list_for_each_entry(table, &ctx.net->nft.tables, list) {
- + if (table->afi->family != NFPROTO_NETDEV)
- continue;
-
- - list_for_each_entry(table, &afi->tables, list) {
- - ctx.table = table;
- - list_for_each_entry_safe(chain, nr, &table->chains, list) {
- - if (!nft_is_base_chain(chain))
- - continue;
- + ctx.family = table->afi->family;
- + ctx.table = table;
- + list_for_each_entry_safe(chain, nr, &table->chains, list) {
- + if (!nft_is_base_chain(chain))
- + continue;
-
- - ctx.chain = chain;
- - nft_netdev_event(event, dev, &ctx);
- - }
- + ctx.chain = chain;
- + nft_netdev_event(event, dev, &ctx);
- }
- }
- nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- --- a/net/netfilter/nft_compat.c
- +++ b/net/netfilter/nft_compat.c
- @@ -161,7 +161,7 @@ nft_target_set_tgchk_param(struct xt_tgc
- {
- par->net = ctx->net;
- par->table = ctx->table->name;
- - switch (ctx->afi->family) {
- + switch (ctx->family) {
- case AF_INET:
- entry->e4.ip.proto = proto;
- entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
- @@ -192,7 +192,7 @@ nft_target_set_tgchk_param(struct xt_tgc
- } else {
- par->hook_mask = 0;
- }
- - par->family = ctx->afi->family;
- + par->family = ctx->family;
- par->nft_compat = true;
- }
-
- @@ -283,7 +283,7 @@ nft_target_destroy(const struct nft_ctx
- par.net = ctx->net;
- par.target = target;
- par.targinfo = info;
- - par.family = ctx->afi->family;
- + par.family = ctx->family;
- if (par.target->destroy != NULL)
- par.target->destroy(&par);
-
- @@ -409,7 +409,7 @@ nft_match_set_mtchk_param(struct xt_mtch
- {
- par->net = ctx->net;
- par->table = ctx->table->name;
- - switch (ctx->afi->family) {
- + switch (ctx->family) {
- case AF_INET:
- entry->e4.ip.proto = proto;
- entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
- @@ -440,7 +440,7 @@ nft_match_set_mtchk_param(struct xt_mtch
- } else {
- par->hook_mask = 0;
- }
- - par->family = ctx->afi->family;
- + par->family = ctx->family;
- par->nft_compat = true;
- }
-
- @@ -523,7 +523,7 @@ __nft_match_destroy(const struct nft_ctx
- par.net = ctx->net;
- par.match = match;
- par.matchinfo = info;
- - par.family = ctx->afi->family;
- + par.family = ctx->family;
- if (par.match->destroy != NULL)
- par.match->destroy(&par);
-
- @@ -754,7 +754,7 @@ nft_match_select_ops(const struct nft_ct
-
- mt_name = nla_data(tb[NFTA_MATCH_NAME]);
- rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
- - family = ctx->afi->family;
- + family = ctx->family;
-
- /* Re-use the existing match if it's already loaded. */
- list_for_each_entry(nft_match, &nft_match_list, head) {
- @@ -845,7 +845,7 @@ nft_target_select_ops(const struct nft_c
-
- tg_name = nla_data(tb[NFTA_TARGET_NAME]);
- rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
- - family = ctx->afi->family;
- + family = ctx->family;
-
- if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
- strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
- --- a/net/netfilter/nft_ct.c
- +++ b/net/netfilter/nft_ct.c
- @@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct
- if (tb[NFTA_CT_DIRECTION] == NULL)
- return -EINVAL;
-
- - switch (ctx->afi->family) {
- + switch (ctx->family) {
- case NFPROTO_IPV4:
- len = FIELD_SIZEOF(struct nf_conntrack_tuple,
- src.u3.ip);
- @@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct
- if (err < 0)
- return err;
-
- - err = nf_ct_netns_get(ctx->net, ctx->afi->family);
- + err = nf_ct_netns_get(ctx->net, ctx->family);
- if (err < 0)
- return err;
-
- @@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct
- if (err < 0)
- goto err1;
-
- - err = nf_ct_netns_get(ctx->net, ctx->afi->family);
- + err = nf_ct_netns_get(ctx->net, ctx->family);
- if (err < 0)
- goto err1;
-
- @@ -564,7 +564,7 @@ err1:
- static void nft_ct_get_destroy(const struct nft_ctx *ctx,
- const struct nft_expr *expr)
- {
- - nf_ct_netns_put(ctx->net, ctx->afi->family);
- + nf_ct_netns_put(ctx->net, ctx->family);
- }
-
- static void nft_ct_set_destroy(const struct nft_ctx *ctx,
- @@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const str
- struct nft_ct *priv = nft_expr_priv(expr);
-
- __nft_ct_set_destroy(ctx, priv);
- - nf_ct_netns_put(ctx->net, ctx->afi->family);
- + nf_ct_netns_put(ctx->net, ctx->family);
- }
-
- static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
- @@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const
- struct nft_ct_helper_obj *priv = nft_obj_data(obj);
- struct nf_conntrack_helper *help4, *help6;
- char name[NF_CT_HELPER_NAME_LEN];
- - int family = ctx->afi->family;
- + int family = ctx->family;
-
- if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
- return -EINVAL;
- @@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const
-
- switch (family) {
- case NFPROTO_IPV4:
- - if (ctx->afi->family == NFPROTO_IPV6)
- + if (ctx->family == NFPROTO_IPV6)
- return -EINVAL;
-
- help4 = nf_conntrack_helper_try_module_get(name, family,
- priv->l4proto);
- break;
- case NFPROTO_IPV6:
- - if (ctx->afi->family == NFPROTO_IPV4)
- + if (ctx->family == NFPROTO_IPV4)
- return -EINVAL;
-
- help6 = nf_conntrack_helper_try_module_get(name, family,
- --- a/net/netfilter/nft_flow_offload.c
- +++ b/net/netfilter/nft_flow_offload.c
- @@ -151,7 +151,7 @@ static int nft_flow_offload_init(const s
- priv->flowtable = flowtable;
- flowtable->use++;
-
- - return nf_ct_netns_get(ctx->net, ctx->afi->family);
- + return nf_ct_netns_get(ctx->net, ctx->family);
- }
-
- static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
- @@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(con
- struct nft_flow_offload *priv = nft_expr_priv(expr);
-
- priv->flowtable->use--;
- - nf_ct_netns_put(ctx->net, ctx->afi->family);
- + nf_ct_netns_put(ctx->net, ctx->family);
- }
-
- static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)
- --- a/net/netfilter/nft_log.c
- +++ b/net/netfilter/nft_log.c
- @@ -112,7 +112,7 @@ static int nft_log_init(const struct nft
- break;
- }
-
- - err = nf_logger_find_get(ctx->afi->family, li->type);
- + err = nf_logger_find_get(ctx->family, li->type);
- if (err < 0)
- goto err1;
-
- @@ -133,7 +133,7 @@ static void nft_log_destroy(const struct
- if (priv->prefix != nft_log_null_prefix)
- kfree(priv->prefix);
-
- - nf_logger_put(ctx->afi->family, li->type);
- + nf_logger_put(ctx->family, li->type);
- }
-
- static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
- --- a/net/netfilter/nft_masq.c
- +++ b/net/netfilter/nft_masq.c
- @@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx *
- }
- }
-
- - return nf_ct_netns_get(ctx->net, ctx->afi->family);
- + return nf_ct_netns_get(ctx->net, ctx->family);
- }
- EXPORT_SYMBOL_GPL(nft_masq_init);
-
- --- a/net/netfilter/nft_meta.c
- +++ b/net/netfilter/nft_meta.c
- @@ -341,7 +341,7 @@ static int nft_meta_get_validate(const s
- if (priv->key != NFT_META_SECPATH)
- return 0;
-
- - switch (ctx->afi->family) {
- + switch (ctx->family) {
- case NFPROTO_NETDEV:
- hooks = 1 << NF_NETDEV_INGRESS;
- break;
- @@ -372,7 +372,7 @@ int nft_meta_set_validate(const struct n
- if (priv->key != NFT_META_PKTTYPE)
- return 0;
-
- - switch (ctx->afi->family) {
- + switch (ctx->family) {
- case NFPROTO_BRIDGE:
- hooks = 1 << NF_BR_PRE_ROUTING;
- break;
- --- a/net/netfilter/nft_nat.c
- +++ b/net/netfilter/nft_nat.c
- @@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft
- return -EINVAL;
-
- family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
- - if (family != ctx->afi->family)
- + if (family != ctx->family)
- return -EOPNOTSUPP;
-
- switch (family) {
- --- a/net/netfilter/nft_redir.c
- +++ b/net/netfilter/nft_redir.c
- @@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx
- return -EINVAL;
- }
-
- - return nf_ct_netns_get(ctx->net, ctx->afi->family);
- + return nf_ct_netns_get(ctx->net, ctx->family);
- }
- EXPORT_SYMBOL_GPL(nft_redir_init);
-
|